CVE-2026-1536
Medium · 5.8CVSS
5.8
EPSS
0.3%
Published
Jan 28, 2026
CISA due date
—
The record
A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup | 0 | 3.4.4-150600.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 0 | 3.4.4-150600.3.31.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.31.1 |
| openSUSE:Leap 16.0 | libsoup | 0 | 3.6.5-160000.4.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.5-12.1 |
Related vulnerabilities
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup
- CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup
- CVE-2026-1761 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup
- CVE-2026-0716 A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. Also affects libsoup